CVE-2025-62221
Published: 09 December 2025
Description
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely remediation of identified flaws like this use-after-free vulnerability through patching, as prioritized by CISA KEV and Microsoft guidance.
Implements memory safeguards such as DEP and ASLR to mitigate use-after-free exploits that enable privilege escalation in the driver.
Requires vulnerability scanning to identify affected Windows systems running the vulnerable Cloud Files Mini Filter Driver for prompt remediation.
Security SummaryAI
CVE-2025-62221 is a use-after-free vulnerability (CWE-416) in the Windows Cloud Files Mini Filter Driver. This flaw affects Windows systems utilizing the driver, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It was published on 2025-12-09.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Successful exploitation enables privilege escalation, granting high-impact access to confidentiality, integrity, and availability of the system.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62221 provides details on patches and mitigation steps. The vulnerability is also listed in CISA's Known Exploited Vulnerabilities catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-62221, indicating active exploitation in the wild.
Security practitioners should prioritize patching affected Windows systems, as real-world exploitation has been observed per CISA.
Details
- CWE(s)
- KEV Date Added
- 09 December 2025
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Windows Cloud Files Mini Filter Driver enables local privilege escalation from low privileges, directly mapping to Exploitation for Privilege Escalation (T1068).